cPanel phishing scam

No matter who you are hosted with, please don’t be taken in by a new phishing scam trying to get your cPanel login.

It is a pretty convincing copy of a genuine notification that you have filled your disk space and has the subject WARNING The domain “(example)” has reached their disk quota.

At first I thought the 123host server was sending them, so I was confused as the accounts weren’t full and the date was wonky. I eventually discovered that one of the links in the email is to a site with a fake cPanel login (the pink highlight). 

A good thing to help spot a fake, though they may fix this, is that the dates are inconsistent (yellow highlight).

Screenshot of fake cpanel email

Four customers had contacted me asking why their disk is full, in each case it wasn’t.  So this is definitely a thing.  I have since had a bunch more reports of the same thing.

You can always check how much disk space you are using in cPanel.

If you receive one of these ignore it.  If you are a customer you can send it to me to double check for you if you want.

If you have received it, clicked the link and entered your cPanel login details, you need to let me (or your hosting service) know URGENTLY so your cPanel password can be changed.


May 2021 newsy thing

Thanks for your ongoing support for 123host by being a customer. 123host is your classic “small business”, which means I can give personalised support and be agile, not necessarily having rigid policies. I get the opportunity to watch projects progress from an idea to fruition…you aren’t an anonymous username to me.

Why you should invest in a domain name -

Keep in mind that pretty soon plain .au domains are going to become available.  For example I will most definitely register  If you have a .au domain (, etc) already, you will be given first option to grab your domain in plain .au.  You don’t have to do this, but I don’t think it will be expensive.  I will update everyone when I hear more.

While we are on domains, some of you are going to receive an email from the domain registry, emailing on behalf of 123host.  It seems they have done an audit of ABNs and Business Numbers used to register .au domains and have identified those that have expired or are invalid for some reason. There are about 30 people with domains that won’t be able to be renewed if their details aren’t updated.  This is completely out of my hands and I am happy to give you some ideas if you do receive one of these emails.  The first thing to do is not panic, in most cases it will be easy to resolve if you want to keep the domain – contact me.

I learned something recently, but first some background. If you have a multi-word domain, especially if it has the same letter at the end of one word and the start of the next, it can be hard to read when written e.g. (I just made that up). Many of you would have had me suggest Camel Case, so the domain would read – this is perfectly legitimate and doesn’t need any settings or anything…just get in the habit of writing your domain like that. It is much easier to read and more memorable.

But I learned there are other lettering cases too.

camelCase, PascalCase, snake_case, kebab-case - notacje w kodzie - YouTube

As I mentioned, my favourite, Camel Case; “TheQuickBrownFoxJumpsOverTheLazyDog”. But did you know that there is also Snake Case? “the_quick_brown_fox_jumps_over_the_lazy_dog”? I didn’t. So I did a bit of research and discovered the delightfully named Kebab Case “the-quick-brown-fox-jumps-over-the-lazy-dog”. I suggest you drop this bit of trivia into a conversation one day to appear very smart and geeky.

I know I waffle on about awesome customer service and truly try to live up to the 123host slogan of “giving the level of customer service I wish I received elsewhere“. I shake my head when I send an email somewhere and they auto respond “you should receive a reply in 48 – 72 hours“. I reckon I am living up to the 123host promise; during May, 58% of support tickets were answered within 1 hour and 73% were answered within 4 hours. I am pretty happy with that. To open a support ticket you can either log into the client area at (this verifies you) or send an email to – if it is an email, I may ask you to verify yourself if I need to make any critical changes.

CleverReach® Official Newsletter Plugin for WordPress

WordPress continues to dominate as the software of choice. Please make sure your are keeping your plugins and the WordPress core up to date (Currently 5.7.1) or you may suffer the same fate as a new 123host customer whose site had been shut down elsewhere because out of date plugins had allowed malware to be inserted into his site. Keeping things up to date is relatively easy. Log into your WP dashboard and you should be notified of anything out of date. Updating is a couple of clicks.

If you want it to be even easier, subscribe to the 123host WordPress management service. I keep everything up to date for you and help with other administrative and security related tasks. You receive a monthly report on all the activity carried out. It is only $55 per year and includes some bonuses like a Divi license and any other perks I spot for subscribers. More information at

Change the sort order of domains in WHMCS

WHMCS is popular software used to manage a web hosting business. It works, but it can be clunky and the company frustrates me with what appears to be a culture of denial about problems. I am posting this so that hopefully other WHMCS users can find a solution to a hair-tearing problem that the company hasn’t fixed despite it being brought to their attention.

The problem:

Now that there is about 500 domains available managing them and keeping them in any sort of meaningful order is close to impossible. Wholesale prices are regularly changing and maintaining just that can be tricky. The issue is that the domains are in some sort of random order, it seems to be based on the order in which they are added to the system. That is fair enough, there has to be some sort of default, but then re-ordering them should be easy, but it is a nightmare.

See the circled handle below? The way they have it set is that you have to grab that, one at a time, and drag it to the position you want the domain.

Imagine trying to do that for 500 domains that are not in alphabetical order but you want them to be. It would be hard enough if it was simply a long list, but in a browser where you have to drag and scroll at the same time…forget it.

A solution:

This solution is a bit complex and not for the faint of heart, but if you are running a server you should have the skills to be able to follow quite easily.

Firstly, and do I even need to say this, back up your data. We are going to do that anyway, but is it possible to have too many backups?

Jump into PHPmyAdmin open the table tbldomainpricing and export it as a CSV file. This is a backup, but we are also going to manipulate it, so make a copy if you want.

Open the table in a spreadsheet, I used Google Sheets because it is so easy. Once opened you will see that column A is the domain ID, Column B is the domain name and column H is the sort order.

The first thing I did was to order the sheet by Column B, A->Z as that is what I am after, an alphabetical list.

We can immediately see the scale of the problem, ideally, Column H should be sequential numbers, it is way off.

Fortunately with spreadsheets, filling a column with sequential values is trivially easy. Firstly put the number 1 in row 1 and 2 in row 2 like this. (They yellow is just highlighting).

Next select both row 1 and row 2. The easiest way is to hold the shift key and click H1 then H2 it will look like this

The important thing to note is the handle on the bottom right of the blue square. Grab it and drag it down, all the way to the bottom of the column…yeah it is tedious, but it is easy.

If you want to test, you can always drag it a little way and let it go to see the outcome.

Once you have dragged all the way to the bottom and released the handle your domains will be have the database order column (Column H) in sequential order, assuming the domain name column (Column A) was ordered alphabetically as well.

Now is your opportunity to bump any popular or featured domains to the top of the WHMCS list. Simply change the value in Column H to 0. You can have multiple identical valued domains, they will be kept in numerical order then ordered alphabetically. I am not going to elaborate on the logic here…if you aren’t following, you really shouldn’t be messing with databases.

We are ready to save the sheet or if you are in Google Sheets, you need to download it as a CSV – click file > download and in your browser you may have to click save file.

Now we are going back to PHPmyAdmin and the database. Most importantly, make sure you have that original CSV file as a backup or another way to restore your database.

Empty the tbldomainpricing table and import your CSV file, that should get your WHMCS domains in alphabetical order on your site.

Of course, it would be easier if WHMCS came up with a way to do this painlessly, and they might, but I won’t hold my breath when despite conceding the current process is difficult, their attitude is “If we receive feedback from other users in this vein then it will only help informing our prioritisation of such work.”

Wide open spaces

The server restart referred to in the last post was used as part of updating the amount of storage. Did I say updating? I meant doubling.

There is now twice as much disk space on the server giving us all room to grow. I am committed to not having the server get overcrowded, often an issue if you use a cheap hosting service.

To “celebrate” I have doubled the storage quota for each plan.

Basic hosting has bumped from 15Gb to 30Gb and Advanced Hosting is up from 50Gb to 100Gb.

Use the space wisely grasshopper.

Another layer of security

I confess to now being security paranoid. I hope I don’t become obsessive…then again, it might not be a bad thing.

In order to share bits of code, passwords, whatever there is now a resource at Paste your bits in there, click “send” and you will be given a URL to share with the recipient.

NOTHING is seen or retained by the server (or me) unless I get the URL

If you check the “burn” box the data will only be viewable once.

123host – keeping the internet safe for kittens.

WordPress management

While doing some research for a recent email to all customers about a severe WordPress bug, I came across a solution where I can manage the administration side of your WordPress site without having to log in to it.

The task I look after on your behalf include

    • Updating WordPress
    • Update plugins
    • Update themes  (on request. I am reluctant to update themes in case it over-writes your customisation)
    • Broken link checker
    • Ensure https compliance
    • Monthly report to you
    • other things…

123host is pretty much all inclusive.  I have always disliked the way some hosting businesses start with a cheap base price and then charge extra for every little thing.

However subscribing to this service is quite expensive for me and I pay based on the number of sites connected, so if you would like to have me manage the trickier part of your WordPress dashboard the cost is $55 inc GST per year* for your first site and $33* for additional sites.  This about $1 per week for peace of mind!

* yeah, the fine print - these prices were correct when I wrote this, it might have changed.

Possible service disruption

This coming Saturday morning (March 4th [NOT February 4th like I said in the email :o( ] ) from 0200 Eastern Australia Time there is a possibility of individual sites being down for a short period. While this is bad news, it is the prelude to some good news.

123host is growing and is moving to a brand new more powerful server with an upgraded operating system and component software. I’ll give some technical details later and not bore those that aren’t interested.

The data centre has suggested that since they are going to move sites individually and change the settings for each account one at a time, disruption will be minimal if at all. This is promising…in theory…but I know that nothing is foolproof, hence this email to give you notice.

We have investigated settings and as far as we can tell you likely won’t even notice the change except things may be faster. However if there are any problems come Saturday morning, send an email to immediately.

Tech specs of the new server – if you are interested in what it all means, do ask.

  • E3-1270v5 Latest Intel Skylake Architecture
  • 48GB DDR4 RAM
  • 4 x 2TB SATA Drives
  • Hardware RAID 10
  • 10TB Bandwidth
  • CentOS 7.x latest
  • PHP 7
  • cPanel latest

If you are one of the people who opted out of newsletters, stop reading now!


Ages ago I advised about free SSL certificates being issued to every domain. Read this for my thoughts going back to September last year.

I know that some of you have moved your sites to https instead of http and I have assisted with a few of them. Unfortunately it sometimes isn’t straightforward and here is the unavoidable technical talk made as simple as possible

When using an SSL certificate, data is encrypted while transferred back and forward between the 123host server and a visitor to your site.   People may intercept your data (unlikely), but shouldn’t be able to decrypt it. Easy to understand so far?

The problem comes when within your site some content is included using http instead of https, it could be a link to a style sheet, an embedded image or something else. This results in a ‘mixed content’ warning because insecure content (http) is being included in a secure page (https). Still with me?

When there is mixed content, instead of the page having a ‘secure’ padlock


it is displayed as insecure.





Not only is the data not secure, there is also apparently a penalty in search engine ranking for insecure sites.

You can test your site easily. Simply use https:// instead of http:// and see what happens. If you get the padlock and secure notification jump in the air and click your heels being careful not to hurt your back. If it doesn’t work as expected you can sort it out yourself or ask for my help – and I am happy to lend a hand. But…

This is my final offer to help people switch to https for free. After April 1st I will charge $55 inc GST to help you do this no matter how simple or complex. You already have the free SSL certificate, it is now up to you.

Looking for a unique domain?

I have just added hundreds of new domain types to the list of domains to register.  You can now register domains such as,, and more – there is wide enough choice to suit just about every individual or business.

Here’s an offer to get you started; for a limited time .me domains are only $15 per year to register and then $35 per year to renew. But if you grab www.(YourName).me for up to 5 years when registering, you get the discount price for the duration.

How is that? – and yes, this is a real URL these days.


This won’t apply to everyone, only those of you using WordPress.

I am pretty easy going and try to be generous with my time and skills, but am going to start billing people who have problems and they haven’t listened when I advise about upgrading WordPress. There are some serious issues with older versions, several sites had content injected into them earlier this month when a security hole was discovered.

The current version of WP is 4.7.2 and upgrading is usually trivial – log into your dashboard and in the At A Glance box it will tell you the version number and generally advise if there is an upgrade available…one click will then do the job.

Here’s another ‘amnesty’ offer. If you need help upgrading ask before April 1st or you are the fool as it will cost you $55.


And to finish up, I have been pretty disillusioned with the unfunny stuff on facebook recently to the point where I have cut down how much I use it.  So here’s something to lift my, and hopefully your, spirits and a compilation of Buster Keaton stunts to make you laugh

September Newsletter – Delhi Belly edition

It’s September edition of the 123host newsletter. As you may have noticed by now I like to come up with a theme and this month is no different. Welcome to the Delhi Belly edition! Spot the bad puns.

Things will be a little loose from September 11th for few weeks as I take a long promised holiday and head to India. I have been to a lot of countries, but this is my first time there. People have warned me that INDIA stands for I’ll Never Do It Again – we shall see.

While I am looking forward to the adventure, I am pretty anxious about 123host running smoothly and the great customer support continuing seamlessly. I will be checking in as often as possible but I didn’t want to spend all my time thinking about tech support when my main worry may be locating the nearest toilet. I’d like to introduce you to David who is going to be looking after you while I am gone. He lives in Northern Queensland and runs a similar business to 123host. We are going to swap skills, down the track I will look after his hosting service when he needs a break. I am confident you will be taken care of as I have reminded him many times about how important customer service is :o)

While David looks after you, I have engaged a server management team to do the technical stuff. I am even going to visit them when I am in Cochin (Western India). I have had a support contract with them for a while for any stuff I couldn’t figure out and they have been fast and efficient. So as long as I avoid their water, things should go well.

Why India? I want to see crazy stuff like this

All you WordPress users take note: WordPress recently upgraded to version 4.3 – it is really important that you make sure your installation is up to date. If not and your site is compromised via a known exploit I am afraid my willingness to help sort you out may be less than enthusiastic. On the other hand, if you are up to date and your plugins are all updated I will do what I can to help clean up the mess.

Last newlestter I explained about a new spam filtering thingy known as greylisting. I am interested in feedback on whether you have noticed any difference – I have. Gmail keeps spam for 30 days before automatically deleting it. A month ago there was 9,000+ items in my spam folder…yes over 9,000 – crap! As I am typing this the current count is less than 5,500 – so I am down by about 30%. This is good.

There can be side-effects though. A couple of people have contacted me about weird bounce emails so an explanation of how this works is in order. When an email comes in, the 123host mail server says to the sending mail server “Sorry, not available right now, try again” – this is a legitimate response from a mail server. Most spam comes from compromised servers so when 123host tries to contact the sending mail server and fails, the spam is never re-delivered. If it is genuine email then the sending mail server gets the ‘busy’ message and trieds to deliver the email again. This time and for the next 10 days 123host will accept it without checking. Some mail servers (it is pretty unusual) will report to the sender “your email has been delayed and will be retried” and people somethimes think it means their email has bounced. So if you have someone say “your email bounced” do check with them whether or not it was just a warning about the email being delayed.

Why India? Bad Bollywood

As you may have noticed, unlike most hosting companies, I am pretty easy going with things like bandwidth and disk quotas. Bump the limit and most often I will give you a bit more resources. But there is one area where I am Mr Tough Guy (TM) and that is security. If anything you do – or someone else tries to do – on your account will affect the entire server I will step in quickly and maybe even automatically to limit any collateral damage. I know I have mentioned before and remind you that the server and your account is under constant pressure from people trying to get past logins.

I have a security setting that will automatically block an IP address via the firewall if there are more than 20 failed login attempts in 3 minutes. This has some explosive side effects. If you fail to login that many times via email or wordpress or wherever, your IP address will be blocked. You won’t be able to access your own site or anything else on the server. It is easy peasy for me to fix: if you can’t get in and you also can’t see head to and send me your IP address in a support ticket. Like me in India, you will be quickly unblocked.

I hope your online adventures are still fun.

If you are midly interested in following my adventures: – in progress…

After all that typing I am pooped.